assign-gingerly 0.0.71 → 0.0.72

package/eachTime.ts

@@ -4,7 +4,9 @@
  * Provides event-driven iteration over elements as they mount
  */
 
-import type { IAssignGingerlyOptions } from './types/assign-gingerly/types.js';
+import type { IAssignGingerlyOptions } from './types/assign-gingerly/types.js';
+import type { AssignPermissions, RestrictedPropSettingsMap } from './isAllowedImportPath.js';
+import { redirectRestrictedProp } from './isAllowedImportPath.js';
 
 /**
  * Check if a value is an EventTarget
@@ -29,9 +31,11 @@ export async function handleEachTime(
   pathParts: string[],
   forEachIndex: number,
   value: any,
-  withMethods: Set<string> | undefined,
-  aliasMap: Map<string, string>,
-  options?: IAssignGingerlyOptions
+  withMethods: Set<string> | undefined,
+  aliasMap: Map<string, string>,
+  options?: IAssignGingerlyOptions,
+  permissions?: AssignPermissions,
+  restrictedPropSet?: RestrictedPropSettingsMap
 ): Promise<void> {
   // Validate signal - required for cleanup
   if (!options?.signal) {
@@ -92,7 +96,10 @@ export async function handleEachTime(
             // Last segment is a method - call it
             const method = result.target[result.lastKey];
             if (typeof method === 'function') {
-              if (Array.isArray(value)) {
+              if (result.isZeroArg) {
+                // Trailing | marker - call with no arguments, ignoring the value
+                method.call(result.target);
+              } else if (Array.isArray(value)) {
                 method.apply(result.target, value);
               } else {
                 method.call(result.target, value);
@@ -103,7 +110,9 @@ export async function handleEachTime(
             const lastKey = result.lastKey;
             const parent = result.target;
             
-            if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+            if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
+              // skip
+            } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
               // Check if property exists and is readonly
               if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
                 const currentValue = parent[lastKey];
@@ -113,7 +122,7 @@ export async function handleEachTime(
                   );
                 }
                 // Recursively apply assignGingerly
-                assignGingerly(currentValue, value, options);
+                assignGingerly(currentValue, value, options, permissions);
               } else {
                 // Property is writable - replace it
                 parent[lastKey] = value;

package/evaluatePathWithAsyncMethods.js

@@ -28,12 +28,19 @@ export async function evaluatePathWithAsyncMethods(target, pathParts, value, wit
     while (i < pathParts.length - 1) {
         const part = pathParts[i];
         const nextPart = pathParts[i + 1];
-        if (withAsyncMethods.has(part)) {
+        // A trailing | marks a zero-argument method call: 'deref|' calls deref()
+        // without consuming the next segment. Only applies to listed method names.
+        const isZeroArgSync = part.endsWith('|') && withMethods.has(part.slice(0, -1));
+        const isZeroArgAsync = part.endsWith('|') && withAsyncMethods.has(part.slice(0, -1));
+        const baseName = (isZeroArgSync || isZeroArgAsync) ? part.slice(0, -1) : part;
+        const nextIsMethod = withAsyncMethods.has(nextPart) || withMethods.has(nextPart)
+            || (nextPart.endsWith('|') && (withAsyncMethods.has(nextPart.slice(0, -1)) || withMethods.has(nextPart.slice(0, -1))));
+        if (withAsyncMethods.has(part) || isZeroArgAsync) {
             // Async method — call and await
-            const method = current[part];
+            const method = current[baseName];
             if (typeof method === 'function') {
-                if (withAsyncMethods.has(nextPart) || withMethods.has(nextPart)) {
-                    // Next is also a method — call current with no args
+                if (isZeroArgAsync || nextIsMethod) {
+                    // Zero-arg call — next is either a method or explicitly not an argument
                     current = await method.call(current);
                 }
                 else {
@@ -44,18 +51,18 @@ export async function evaluatePathWithAsyncMethods(target, pathParts, value, wit
             }
             else {
                 // Not a function — just access property
-                if (current[part] === undefined || current[part] === null) {
-                    current[part] = {};
+                if (current[baseName] === undefined || current[baseName] === null) {
+                    current[baseName] = {};
                 }
-                current = current[part];
+                current = current[baseName];
             }
         }
-        else if (withMethods.has(part)) {
+        else if (withMethods.has(part) || isZeroArgSync) {
             // Sync method — same logic as evaluatePathWithMethods
-            const method = current[part];
+            const method = current[baseName];
             if (typeof method === 'function') {
-                if (withMethods.has(nextPart) || withAsyncMethods.has(nextPart)) {
-                    // Next is also a method — call current with no args
+                if (isZeroArgSync || nextIsMethod) {
+                    // Zero-arg call — next is either a method or explicitly not an argument
                     current = method.call(current);
                 }
                 else {
@@ -65,10 +72,10 @@ export async function evaluatePathWithAsyncMethods(target, pathParts, value, wit
                 }
             }
             else {
-                if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-                    current[part] = {};
+                if (!(baseName in current) || typeof current[baseName] !== 'object' || current[baseName] === null) {
+                    current[baseName] = {};
                 }
-                current = current[part];
+                current = current[baseName];
             }
         }
         else {
@@ -80,11 +87,17 @@ export async function evaluatePathWithAsyncMethods(target, pathParts, value, wit
         }
         i++;
     }
-    const lastKey = pathParts[pathParts.length - 1];
+    // Strip a trailing | from the last segment only when it names a listed method;
+    // otherwise it is a literal property name (e.g. an exotic key ending in |).
+    const rawLastKey = pathParts[pathParts.length - 1];
+    const isZeroArg = rawLastKey.endsWith('|')
+        && (withMethods.has(rawLastKey.slice(0, -1)) || withAsyncMethods.has(rawLastKey.slice(0, -1)));
+    const lastKey = isZeroArg ? rawLastKey.slice(0, -1) : rawLastKey;
     return {
         target: current,
         lastKey,
         isMethod: withMethods.has(lastKey),
-        isAsyncMethod: withAsyncMethods.has(lastKey)
+        isAsyncMethod: withAsyncMethods.has(lastKey),
+        isZeroArg
     };
 }

package/evaluatePathWithAsyncMethods.ts

@@ -16,6 +16,7 @@ export interface AsyncPathResult {
     lastKey: string;
     isMethod: boolean;
     isAsyncMethod: boolean;
+    isZeroArg: boolean;
 }
 
 /**
@@ -44,12 +45,20 @@ export async function evaluatePathWithAsyncMethods(
         const part = pathParts[i];
         const nextPart = pathParts[i + 1];
 
-        if (withAsyncMethods.has(part)) {
+        // A trailing | marks a zero-argument method call: 'deref|' calls deref()
+        // without consuming the next segment. Only applies to listed method names.
+        const isZeroArgSync = part.endsWith('|') && withMethods.has(part.slice(0, -1));
+        const isZeroArgAsync = part.endsWith('|') && withAsyncMethods.has(part.slice(0, -1));
+        const baseName = (isZeroArgSync || isZeroArgAsync) ? part.slice(0, -1) : part;
+        const nextIsMethod = withAsyncMethods.has(nextPart) || withMethods.has(nextPart)
+            || (nextPart.endsWith('|') && (withAsyncMethods.has(nextPart.slice(0, -1)) || withMethods.has(nextPart.slice(0, -1))));
+
+        if (withAsyncMethods.has(part) || isZeroArgAsync) {
             // Async method — call and await
-            const method = current[part];
+            const method = current[baseName];
             if (typeof method === 'function') {
-                if (withAsyncMethods.has(nextPart) || withMethods.has(nextPart)) {
-                    // Next is also a method — call current with no args
+                if (isZeroArgAsync || nextIsMethod) {
+                    // Zero-arg call — next is either a method or explicitly not an argument
                     current = await method.call(current);
                 } else {
                     // Call with next part as string arg, then await
@@ -58,17 +67,17 @@ export async function evaluatePathWithAsyncMethods(
                 }
             } else {
                 // Not a function — just access property
-                if (current[part] === undefined || current[part] === null) {
-                    current[part] = {};
+                if (current[baseName] === undefined || current[baseName] === null) {
+                    current[baseName] = {};
                 }
-                current = current[part];
+                current = current[baseName];
             }
-        } else if (withMethods.has(part)) {
+        } else if (withMethods.has(part) || isZeroArgSync) {
             // Sync method — same logic as evaluatePathWithMethods
-            const method = current[part];
+            const method = current[baseName];
             if (typeof method === 'function') {
-                if (withMethods.has(nextPart) || withAsyncMethods.has(nextPart)) {
-                    // Next is also a method — call current with no args
+                if (isZeroArgSync || nextIsMethod) {
+                    // Zero-arg call — next is either a method or explicitly not an argument
                     current = method.call(current);
                 } else {
                     // Call with next part as string arg
@@ -76,10 +85,10 @@ export async function evaluatePathWithAsyncMethods(
                     i++; // Skip next part since we consumed it as argument
                 }
             } else {
-                if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-                    current[part] = {};
+                if (!(baseName in current) || typeof current[baseName] !== 'object' || current[baseName] === null) {
+                    current[baseName] = {};
                 }
-                current = current[part];
+                current = current[baseName];
             }
         } else {
             // Not a method — normal property access
@@ -92,11 +101,17 @@ export async function evaluatePathWithAsyncMethods(
         i++;
     }
 
-    const lastKey = pathParts[pathParts.length - 1];
+    // Strip a trailing | from the last segment only when it names a listed method;
+    // otherwise it is a literal property name (e.g. an exotic key ending in |).
+    const rawLastKey = pathParts[pathParts.length - 1];
+    const isZeroArg = rawLastKey.endsWith('|')
+        && (withMethods.has(rawLastKey.slice(0, -1)) || withAsyncMethods.has(rawLastKey.slice(0, -1)));
+    const lastKey = isZeroArg ? rawLastKey.slice(0, -1) : rawLastKey;
     return {
         target: current,
         lastKey,
         isMethod: withMethods.has(lastKey),
-        isAsyncMethod: withAsyncMethods.has(lastKey)
+        isAsyncMethod: withAsyncMethods.has(lastKey),
+        isZeroArg
     };
 }

package/handlers/addEventListener.js

@@ -37,7 +37,7 @@ function extractShorthand(config) {
 /**
  * Process a single AssignDispatchVector — execute all toTarget/toHost/toLHS assignments.
  */
-function processVector(vector, source, target, host, lhs, inheritedOptions, useAssignFrom) {
+function processVector(vector, source, target, host, lhs, inheritedOptions, useAssignFrom, permissions) {
     const destinations = [
         { key: 'toTarget', dest: target },
         { key: 'toHost', dest: host },
@@ -50,11 +50,11 @@ function processVector(vector, source, target, host, lhs, inheritedOptions, useA
         if (useAssignFrom && source != null) {
             // Dynamic import assignFrom on demand (fire-and-forget context, already async)
             import('../assignFrom.js').then(({ assignFrom }) => {
-                assignFrom(dest, pattern, { from: source, ...inheritedOptions, ...vector.withOptions });
+                assignFrom(dest, pattern, { from: source, ...inheritedOptions, ...vector.withOptions }, permissions);
             });
         }
         else {
-            assignGingerly(dest, pattern, inheritedOptions);
+            assignGingerly(dest, pattern, inheritedOptions, permissions);
         }
     }
     // Handle shorthand (implicit toHost)
@@ -62,11 +62,11 @@ function processVector(vector, source, target, host, lhs, inheritedOptions, useA
     if (shorthand) {
         if (useAssignFrom && source != null) {
             import('../assignFrom.js').then(({ assignFrom }) => {
-                assignFrom(host, shorthand, { from: source, ...inheritedOptions, ...vector.withOptions });
+                assignFrom(host, shorthand, { from: source, ...inheritedOptions, ...vector.withOptions }, permissions);
             });
         }
         else {
-            assignGingerly(host, shorthand, inheritedOptions);
+            assignGingerly(host, shorthand, inheritedOptions, permissions);
         }
     }
 }
@@ -79,7 +79,7 @@ function processVector(vector, source, target, host, lhs, inheritedOptions, useA
  * @param host - The options.from (source/view model)
  * @param inheritedOptions - Parent assignFrom options (withMethods, aka, etc.)
  */
-export function attachEventListener(lhs, config, target, host, inheritedOptions) {
+export function attachEventListener(lhs, config, target, host, inheritedOptions, permissions) {
     const { on: eventName, get: getConfig, fromLHS, fromHost, fromTarget, fromEvent, dispatch } = config;
     // Resolve get config values
     const { abortController, key, nudge, options: listenerOptions, stopPropagation, preventDefault, dispatch: getDispatch } = getConfig ?? {};
@@ -112,22 +112,22 @@ export function attachEventListener(lhs, config, target, host, inheritedOptions)
         if (preventDefault)
             event.preventDefault();
         // Static assignments (no from) — top-level toTarget/toHost/toLHS + shorthand
-        processVector(config, null, target, host, lhs, inheritedOptions, false);
+        processVector(config, null, target, host, lhs, inheritedOptions, false, permissions);
         // fromLHS assignments
         if (fromLHS) {
-            processVector(fromLHS, lhs, target, host, lhs, inheritedOptions, true);
+            processVector(fromLHS, lhs, target, host, lhs, inheritedOptions, true, permissions);
         }
         // fromHost assignments
         if (fromHost) {
-            processVector(fromHost, host, target, host, lhs, inheritedOptions, true);
+            processVector(fromHost, host, target, host, lhs, inheritedOptions, true, permissions);
         }
         // fromTarget assignments
         if (fromTarget) {
-            processVector(fromTarget, target, target, host, lhs, inheritedOptions, true);
+            processVector(fromTarget, target, target, host, lhs, inheritedOptions, true, permissions);
         }
         // fromEvent assignments
         if (fromEvent) {
-            processVector(fromEvent, event, target, host, lhs, inheritedOptions, true);
+            processVector(fromEvent, event, target, host, lhs, inheritedOptions, true, permissions);
         }
         // Dispatch custom event if configured
         const dispatchConfig = dispatch || getDispatch;

package/handlers/addEventListener.ts

@@ -7,8 +7,9 @@
  * Attaches an event listener that executes assign vectors on event fire.
  */
 
-import assignGingerly from '../assignGingerly.js';
-import type { AddEventListenerConfig, AssignDispatchVector } from '../types/assign-gingerly/types.js';
+import assignGingerly from '../assignGingerly.js';
+import type { AddEventListenerConfig, AssignDispatchVector } from '../types/assign-gingerly/types.js';
+import type { AssignPermissions } from '../isAllowedImportPath.js';
 
 /**
  * WeakMap for dedup: Element → Map<key, AbortController>
@@ -48,9 +49,10 @@ function processVector(
     source: any,
     target: any,
     host: any,
-    lhs: Element,
-    inheritedOptions: any,
-    useAssignFrom: boolean
+    lhs: Element,
+    inheritedOptions: any,
+    useAssignFrom: boolean,
+    permissions?: AssignPermissions
 ): void {
     const destinations = [
         { key: 'toTarget' as const, dest: target },
@@ -64,10 +66,10 @@ function processVector(
         if (useAssignFrom && source != null) {
             // Dynamic import assignFrom on demand (fire-and-forget context, already async)
             import('../assignFrom.js').then(({ assignFrom }) => {
-                assignFrom(dest, pattern, { from: source, ...inheritedOptions, ...vector.withOptions });
+                assignFrom(dest, pattern, { from: source, ...inheritedOptions, ...vector.withOptions }, permissions);
             });
         } else {
-            assignGingerly(dest, pattern, inheritedOptions);
+            assignGingerly(dest, pattern, inheritedOptions, permissions);
         }
     }
 
@@ -76,10 +78,10 @@ function processVector(
     if (shorthand) {
         if (useAssignFrom && source != null) {
             import('../assignFrom.js').then(({ assignFrom }) => {
-                assignFrom(host, shorthand, { from: source, ...inheritedOptions, ...vector.withOptions });
+                assignFrom(host, shorthand, { from: source, ...inheritedOptions, ...vector.withOptions }, permissions);
             });
         } else {
-            assignGingerly(host, shorthand, inheritedOptions);
+            assignGingerly(host, shorthand, inheritedOptions, permissions);
         }
     }
 }
@@ -98,7 +100,8 @@ export function attachEventListener(
     config: AddEventListenerConfig,
     target: any,
     host: any,
-    inheritedOptions: any
+    inheritedOptions: any,
+    permissions?: AssignPermissions
 ): void {
     const { on: eventName, get: getConfig, fromLHS, fromHost, fromTarget, fromEvent, dispatch } = config;
 
@@ -131,26 +134,26 @@ export function attachEventListener(
         if (preventDefault) event.preventDefault();
 
         // Static assignments (no from) — top-level toTarget/toHost/toLHS + shorthand
-        processVector(config, null, target, host, lhs, inheritedOptions, false);
+        processVector(config, null, target, host, lhs, inheritedOptions, false, permissions);
 
         // fromLHS assignments
         if (fromLHS) {
-            processVector(fromLHS, lhs, target, host, lhs, inheritedOptions, true);
+            processVector(fromLHS, lhs, target, host, lhs, inheritedOptions, true, permissions);
         }
 
         // fromHost assignments
         if (fromHost) {
-            processVector(fromHost, host, target, host, lhs, inheritedOptions, true);
+            processVector(fromHost, host, target, host, lhs, inheritedOptions, true, permissions);
         }
 
         // fromTarget assignments
         if (fromTarget) {
-            processVector(fromTarget, target, target, host, lhs, inheritedOptions, true);
+            processVector(fromTarget, target, target, host, lhs, inheritedOptions, true, permissions);
         }
 
         // fromEvent assignments
         if (fromEvent) {
-            processVector(fromEvent, event, target, host, lhs, inheritedOptions, true);
+            processVector(fromEvent, event, target, host, lhs, inheritedOptions, true, permissions);
         }
 
         // Dispatch custom event if configured

package/handlers/lazyLoad.ts

@@ -23,7 +23,8 @@ import type { AssignFromHandler } from '../assignFromAsync.js';
 import type { LazyLoadResolvedParams, LazyLoadInstantiatedContext } from '../types/assign-gingerly/types.js';
 import { withTransition, ensureHideStyle, DEFAULT_HIDE_CLASS } from '../transitionHelper.js';
 import { findMarkers, createMarkers, getNodesBetweenMarkers, findMarkersSibling, createMarkersSibling, MARKER_START_PREFIX, MARKER_END } from '../markerUtils.js';
-import { assignFrom } from '../assignFrom.js';
+import { assignFrom } from '../assignFrom.js';
+import type { AssignPermissions } from '../isAllowedImportPath.js';
 
 export type { LazyLoadResolvedParams, LazyLoadInstantiatedContext };
 
@@ -46,16 +47,18 @@ function getMarkerName(templateEl: any): string {
  * Exported so it can be subclassed for custom behavior.
  */
 export class LazyLoadHandler implements AssignFromHandler {
-    config: any;
-    _options: any;
+    config: any;
+    _options: any;
+    _permissions?: AssignPermissions;
     static #markerCounter = 0;
 
     constructor(config: any) {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: LazyLoadResolvedParams, options?: any): Promise<void> {
-        this._options = options; // Store for applyAssign access
+    async assign(lhsTarget: any, resolvedParams: LazyLoadResolvedParams, options?: any, permissions?: AssignPermissions): Promise<void> {
+        this._options = options; // Store for applyAssign access
+        this._permissions = permissions;
         const {
             if: condition,
             instantiate,
@@ -317,10 +320,10 @@ export class LazyLoadHandler implements AssignFromHandler {
             const len = Math.min(elements.length, assign.configs.length);
             for (let j = 0; j < len; j++) {
                 const cfg = assign.configs[j];
-                assignFrom(elements[j], cfg.toClone ?? {}, { from, ...cfg.withOptions });
+                assignFrom(elements[j], cfg.toClone ?? {}, { from, ...cfg.withOptions }, this._permissions);
             }
         } else if (assign.toClone) {
-            assignFrom(elements[0], assign.toClone, { from, ...assign.withOptions });
+            assignFrom(elements[0], assign.toClone, { from, ...assign.withOptions }, this._permissions);
         }
     }
 

package/handlers/lazyLoadSwitch.ts

@@ -20,7 +20,8 @@
  * }, { withMethods: ['querySelector'], from: vm, protocols: { globalThis: k => globalThis[k] } });
  */
 
-import { LazyLoadHandler } from './lazyLoad.js';
+import { LazyLoadHandler } from './lazyLoad.js';
+import type { AssignPermissions } from '../isAllowedImportPath.js';
 import type { AssignFromHandler } from '../assignFromAsync.js';
 import type { LazyLoadSwitchResolvedParams } from '../types/assign-gingerly/types.js';
 
@@ -55,10 +56,10 @@ function evaluateOp(lhs: any, op: string, rhs: any): boolean {
  */
 export class LazyLoadSwitchHandler extends LazyLoadHandler implements AssignFromHandler {
 
-    async assign(lhsTarget: any, resolvedParams: LazyLoadSwitchResolvedParams): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: LazyLoadSwitchResolvedParams, options?: any, permissions?: AssignPermissions): Promise<void> {
         const { lhs, op = '===', rhs, ...rest } = resolvedParams;
         const condition = evaluateOp(lhs, op, rhs);
         // Delegate to parent with computed condition
-        return super.assign(lhsTarget, { ...rest, if: condition });
+        return super.assign(lhsTarget, { ...rest, if: condition }, options, permissions);
     }
 }

package/handlers/manageTemplateList.js

@@ -55,7 +55,7 @@ export class ManageTemplateListHandler {
     constructor(config) {
         this.config = config;
     }
-    async assign(lhsTarget, resolvedParams, options) {
+    async assign(lhsTarget, resolvedParams, options, permissions) {
         //return;
         const { forEach: items, instantiate, method = 'appendChild', forget = false, markerName, yieldEvery, } = resolvedParams;
         if (!(lhsTarget instanceof Element)) {
@@ -143,7 +143,7 @@ export class ManageTemplateListHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 }
                 else {
@@ -153,13 +153,13 @@ export class ManageTemplateListHandler {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         }
                         else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }
@@ -192,7 +192,7 @@ export class ManageTemplateListHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 }
                 else {
@@ -204,13 +204,13 @@ export class ManageTemplateListHandler {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         }
                         else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }

package/handlers/manageTemplateList.ts

@@ -30,7 +30,8 @@ import type { ManageTemplateListResolvedParams } from '../types/assign-gingerly/
 import { findMarkers, createMarkers, getNodesBetweenMarkers, MARKER_START_PREFIX, MARKER_END } from '../markerUtils.js';
 import { resolveValue } from '../resolveValues.js';
 import { assignFrom } from '../assignFrom.js';
-import { processInferredAssignments } from '../inferredAssignments.js';
+import { processInferredAssignments } from '../inferredAssignments.js';
+import type { AssignPermissions } from '../isAllowedImportPath.js';
 
 /**
  * Reserved keys in fromEachItem config — not treated as shorthand patterns.
@@ -74,7 +75,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any, permissions?: AssignPermissions): Promise<void> {
         //return;
         const {
             forEach: items,
@@ -183,7 +184,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 } else {
                     const rootEl = existingNodes.find(n => n instanceof Element) as Element | undefined;
@@ -191,13 +192,13 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }
@@ -228,7 +229,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 } else {
                     const rootEl = clonedNodes.find(n => n instanceof Element) as Element | undefined;
@@ -239,14 +240,14 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
 
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }

package/handlers/rangeSelector.ts

@@ -22,7 +22,8 @@
  */
 
 import type { AssignFromHandler } from '../assignFromAsync.js';
-import assignGingerly from '../assignGingerly.js';
+import assignGingerly from '../assignGingerly.js';
+import type { AssignPermissions } from '../isAllowedImportPath.js';
 
 /**
  * Operator keys recognized in case objects.
@@ -72,7 +73,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: any): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: any, _options?: any, permissions?: AssignPermissions): Promise<void> {
         const { value, when } = resolvedParams;
 
         if (!Array.isArray(when)) return;
@@ -81,7 +82,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         for (const caseObj of when) {
             if (caseMatches(value, caseObj)) {
                 if (caseObj.merge && typeof caseObj.merge === 'object') {
-                    assignGingerly(lhsTarget, caseObj.merge);
+                    assignGingerly(lhsTarget, caseObj.merge, undefined, permissions);
                 }
                 return; // First match wins
             }